Skip to main content
affpapa.org
RU EN
skill CX Codex

constant-time-analysis — Claude Code skill: how it works

Inspects compiled assembly and bytecode for timing side-channels. It flags secret-dependent branches and variable-time operations in crypto routines.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill constant-time-analysis -a claude-code
Open on GitHub

What constant-time-analysis does

This skill compiles a source file and inspects the resulting assembly or bytecode for variable-time instructions. It flags secret division, modulo operations, and secret-dependent branches. It is purely static analysis. The tool does not execute binaries or take runtime timing measurements.

The analysis runs through ct_analyzer/analyzer.py using uv. It detects languages by file extension across C, C++, Rust, Go, Swift, Java, C#, PHP, JavaScript, Python, and Ruby. For native binaries, you can pass --arch, --compiler, and --opt-level to inspect different optimization passes.

Running without --warnings leaves common timing leaks invisible. Without this flag, early-exit comparisons like memcmp and secret table lookups stay silent. A clean report on -O2 does not prove safety on -O0, where compiler transforms can restore variable-time branches.

What it helps with

  • spot division or modulo instructions operating on secret inputs
  • catch early-exit comparisons like memcmp in authentication tags
  • audit compiler assembly across multiple architectures and optimization levels
  • identify secret-dependent branches before deploying cryptographic routines

Example prompts for the agent

  • Run constant-time analysis on crypto/sign.c targeting arm64 with --warnings.
  • Check src/kem.rs for variable-time branches and secret division.
  • Audit the verify routine in auth_tag.py for early-exit comparisons.

How to install constant-time-analysis

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill constant-time-analysis -a claude-code

2Manually: put the files in place

~/.claude/skills/constant-time-analysis/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/constant-time-analysis/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about constant-time-analysis

How do I install constant-time-analysis in Claude Code?

Run npx skills add trailofbits/skills --skill constant-time-analysis -a claude-code in your terminal.

What does constant-time-analysis check?

It statically examines compiler output and VM bytecode without running the binary. It flags variable-time operations, branch conditions tied to secrets, and early-exit checks.

Why is the --warnings flag necessary?

Default runs show only error-severity findings like division instructions. Flaws such as early-exit comparisons and secret table indexing are warning-level and will be skipped without --warnings.

Similar skills

Everything for Security →
malware-analysis-dragonflyTomb-avast reason-machines A skill for pulling apart repositories that pose as antivirus installers. It helps you tell a fake distribution from the real thing. CX Codex +1 1,000installs static-analysis mohitmishra786 Guides static analysis configuration for C and C++ projects using clang-tidy, cppcheck, and scan-build. It helps filter warnings and triage false positives. CX Codex +1 1,200installs crypto-audit briiirussell Reviews how cryptography is implemented in your code: cipher modes, KDF parameters, IV and nonce handling, signature checks. Useful when the code looks right but still leaks. CX Codex +1 353installs skill-scanner getsentry Scans agent skills for prompt injection, malicious code, excessive permissions, secret exposure, and supply-chain risks before installation. CX Codex +1 3,800installs code-review-pro OneWave-AI Reviews files, a module, a diff or a branch and returns severity-ranked findings: vulnerabilities, correctness bugs, performance and maintainability issues, each with evidence and a fix. CX Codex +1 2,600installs semgrep semgrep Runs Semgrep static analysis and helps you write YAML detection rules. Useful when you need to find vulnerabilities or enforce your own coding standards. CX Codex +1 2,200installs

From the same set77

semgrep-rule-creator A skill that walks you through creating custom Semgrep rules to detect security vulnerabilities and code patterns in your projects. Use it when you need static analysis tailored to your codebase. CX Codex +1 5,800installs solana-vulnerability-scanner Detects 6 critical vulnerabilities across native Rust and Anchor programs on Solana. Helps identify flaws in account validation, PDA derivation, and CPI logic. CX Codex +1 5,600installs token-integration-analyzer Checks ERC20 and ERC721 implementations plus code that integrates external tokens. Use it before accepting tokens with non-standard transfer or approval behaviour. CX Codex +1 5,500installs cargo-fuzz Sets up cargo-fuzz inside a Cargo-based Rust crate and walks through the harness, sanitizers and crash triage. CX Codex +1 5,400installs harness-writing Helps you write and fix a fuzzing harness: map raw bytes onto API arguments, kill non-determinism, stop chasing crashes that never reproduce. CX Codex +1 5,400installs firebase-apk-scanner Unpacks an Android APK, pulls out its Firebase config and probes databases, buckets and functions for open access. Built for mobile app security audits. CX Codex +1 5,400installs guidelines-advisor Audits smart contract codebases against Trail of Bits guidelines. It spots upgradeability pitfalls, flawed inheritance, and testing gaps. CX Codex +1 5,500installs coverage-analysis Measures code reached by a fuzzing campaign and helps explain stalled path discovery. Use it to inspect harness changes, corpus results, and unreachable branches. CX Codex +1 5,500installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor